A small number of my forwarded DNS queries cause BIND 9 to log messages such as:
184.in-addr.arpa SOA: got insecure response; parent indicates it should be secure
validating @0x7f93140c0870: 100.64-26.75.195.82.in-addr.arpa PTR: no valid signature found
validating @0x7f93100c8830: www.nbcnews.com A: no valid signature found
validating @0x7f93287f2a00: cabotelecom.com.br NSEC: verify failed due to bad signature (keyid=13661): RRSIG has expired
I am forwarding queries to a server supporting DNSSEC.
So: should I care about these, given that there is nothing I can do about them? If so, what can I really do about them?